{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,12]],"date-time":"2025-10-12T04:19:36Z","timestamp":1760242776179,"version":"build-2065373602"},"reference-count":40,"publisher":"MDPI AG","issue":"2","license":[{"start":{"date-parts":[[2016,6,15]],"date-time":"2016-06-15T00:00:00Z","timestamp":1465948800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Information"],"abstract":"<jats:p>Security patterns are intended to support software developers as the patterns encapsulate security expert knowledge. However, these patterns may be inappropriately applied because most developers are not security experts, leading to threats and vulnerabilities. Here we propose a support method for security design patterns in the implementation phase of software development. Our method creates a test template from a security design pattern, consisting of an \u201caspect test template\u201d to observe the internal processing and a \u201ctest case template\u201d. Providing design information creates a test from the test template with a tool. Because our test template is reusable, it can easily perform a test to validate a security design pattern. In an experiment involving four students majoring in information sciences, we confirm that our method can realize an effective test, verify pattern applications, and support pattern implementation.<\/jats:p>","DOI":"10.3390\/info7020034","type":"journal-article","created":{"date-parts":[[2016,6,15]],"date-time":"2016-06-15T14:11:19Z","timestamp":1465999879000},"page":"34","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":10,"title":["Implementation Support of Security Design Patterns Using Test Templates"],"prefix":"10.3390","volume":"7","author":[{"given":"Masatoshi","family":"Yoshizawa","sequence":"first","affiliation":[{"name":"Global Software Engineering Laboratory, Department of Computer Science and Engineering, Waseda University, Shinjuku-ku, Tokyo 169-8555, Japan"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1417-9879","authenticated-orcid":false,"given":"Hironori","family":"Washizaki","sequence":"additional","affiliation":[{"name":"Global Software Engineering Laboratory, Department of Computer Science and Engineering, Waseda University, Shinjuku-ku, Tokyo 169-8555, Japan"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yoshiaki","family":"Fukazawa","sequence":"additional","affiliation":[{"name":"Global Software Engineering Laboratory, Department of Computer Science and Engineering, Waseda University, Shinjuku-ku, Tokyo 169-8555, Japan"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Takao","family":"Okubo","sequence":"additional","affiliation":[{"name":"Information Security Division, Institute of Information Security, 2-14-1 Tsuruyacho, Kanagawa-ku, Yokohama, Kanagawa 221-0835, Japan"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Haruhiko","family":"Kaiya","sequence":"additional","affiliation":[{"name":"Department of Information Sciences, Kanagawa University, 2946 Tsuchiya, Hiratsuka-shi, Kanagawa 259-1293, Japan"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1986-5675","authenticated-orcid":false,"given":"Nobukazu","family":"Yoshioka","sequence":"additional","affiliation":[{"name":"GRACE Center, National Institute of informatics, 2-1-2 Hitotsubashi, Chiyoda-ku, Tokyo 101-8430, Japan"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2016,6,15]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"35","DOI":"10.2201\/NiiPi.2008.5.5","article-title":"A Survey on Security Patterns","volume":"5","author":"Yoshioka","year":"2008","journal-title":"Prog. Inform."},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Devanbu, P.T., and Stubblebine, S. (2000, January 4\u201310). Software Engineering for Security: A Roadmap. Proceedings of the Conference on the Future of Software Engineering, New York, NY, USA.","DOI":"10.1145\/336512.336559"},{"key":"ref_3","unstructured":"Schumacher, M., Fernandez-Buglioni, E., Hybertson, D., Buschmann, F., and Sommerlad, P. (2006). Security Patterns: Integrating Security and Systems Engineering, John Wiley & Sons."},{"key":"ref_4","unstructured":"Object Management Group Unified Modeling Language (UML) Version 2.5, 2015. Available online: http:\/\/www.omg.org\/spec\/UML\/."},{"key":"ref_5","unstructured":"Object Management Group OCL 2.4, 2014. Available online: http:\/\/www.omg.org\/spec\/OCL\/2.4\/."},{"key":"ref_6","unstructured":"Warmer, J., and Kleppe, A. (1998). The Object Constraint Language: Precise Modeling with UML, Addison-Wesley."},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Kobashi, T., Yoshizawa, M., Washizaki, H., Fukazawa, Y., Yoshioka, N., Kaiya, H., and Okubo, T. (2015, January 13\u201317). TESEM: A Tool for Verifying Security Design Pattern Applications by Model Testing. Proceedings of the 8th IEEE International Conference on Software Testing, Verification, and Validation (ICST 2015), Graz, Austria.","DOI":"10.1109\/ICST.2015.7102633"},{"key":"ref_8","unstructured":"Fernandez-Buglioni, E. (2013). Security Patterns in Practice: Designing Secure Architectures Using Software Patterns, John Wiley & Sons."},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Munetoh, S., and Yoshioka, N. (2013, January 2\u20136). Model-Assisted Access Control Implementation for Code-centric Ruby-on-Rails Web Application Development. Proceedings of the International Conference on Availability, Reliability and Security, Regensburg, Germany.","DOI":"10.1109\/ARES.2013.47"},{"key":"ref_10","unstructured":"Abramov, J., Shoval, P., and Sturm, A. (2009, January 25). Validating and Implementing Security Patterns for Database Applications. Proceedings of the 3rd International Workshop on Software Patterns and Quality (SPAQu), Orlando, FL, USA."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"274","DOI":"10.1016\/j.infsof.2009.10.001","article-title":"Automated verification of security pattern compositions","volume":"25","author":"Dong","year":"2010","journal-title":"J. Inf. Softw. Technol."},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Hamid, B., Percebois, C., and Gouteux, D. (2012, January 11\u201315). Methodology for Integration of Patterns with Validation Purpose. Proceedings of the European Conference on Pattern Language of Programs (EuroPLoP), Irsee, Germany.","DOI":"10.1145\/2602928.2603084"},{"key":"ref_13","unstructured":"J\u00fcrjens, J. (2005). Secure Systems Development with UML, Springer."},{"key":"ref_14","unstructured":"Lodderstedt, T., Basin, D.A., and Doser, J. (October, January 30). SecureUML: A UML-Based Modeling Language for Model-Driven Security. Proceedings of the 5th International Conference on the Unified Modeling Language (UML), Dresden, Germany."},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Dalal, S.R., Jain, A., Karunanithi, N., Leaton, J.M., Lott, C.M., Patton, G.C., and Horowitz, B.M. (1999, January 16\u201322). Model-based Testing in practice. Proceedings of the International Conference on Software Engineering, Los Angeles, CA, USA.","DOI":"10.1145\/302405.302640"},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"119","DOI":"10.1002\/stvr.1580","article-title":"Model-based security testing: A taxonomy and systematic classification","volume":"26","author":"Felderer","year":"2016","journal-title":"Softw. Test. Verif. Reliab."},{"key":"ref_17","unstructured":"Tretmans, J., and Brinksma, E. (2003, January 11\u201312). TorX: Automated Model-Based Testing. Proceedings of the Conference on Model-Driven Software Engineering, Nuremberg, Germany."},{"key":"ref_18","unstructured":"Felderer, M., Agreiter, B., Breu, R., and Armenteros, A. (2010, January 24\u201326). Security Testing by Telling TestStories. Proceedings of the Conference on Modellierung, Klagenfurt, Austria."},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Schieferdecker, I., Grossmann, J., and Schneider, M. (2012, January 25). Model-based security testing. Proceedings of the 7th Workshop on Model Based Testing, Tallinn, Estonia.","DOI":"10.4204\/EPTCS.80.1"},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Kim, H., Choi, B., and Yoon, S. (2009, January 15\u201316). Performance testing based on test-driven development for mobile applications. Proceedings of the International Conference on Ubiquitous Information Management and Communication, Suwon, Korea.","DOI":"10.1145\/1516241.1516349"},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Fraser, S., Astels, D., Beck, K., Boehm, B., McGregor, J., Newkirk, J., and Poole, C. (2003, January 26\u201330). Discipline and practices of TDD: (test driven development). Proceedings of the Conference on Object-oriented Programming, Systems, Languages, and Applications, Anaheim, CA, USA.","DOI":"10.1145\/949344.949407"},{"key":"ref_22","unstructured":"and Singhal, A. (2011, January 28\u201329). Development of Agile Security Framework Using a Hybrid Technique for Requirements Elicitation. Proceedings of the International Conference on Advances in Computing, Communication and Control (ICAC), Mumbai, India."},{"key":"ref_23","unstructured":"Selenium. Available online: http:\/\/docs.Seleniumhq.org\/."},{"key":"ref_24","unstructured":"Holmes, A., and Kellogg, M. (2006, January 23\u201328). Automating functional tests using Selenium. Proceedings of the Agile Conference, Minneapolis, MN, USA."},{"key":"ref_25","unstructured":"JUnit. Available online: http:\/\/junit.org."},{"key":"ref_26","unstructured":"Tahchiev, P., Leme, F., Massol, V., and Gregory, G. (2010). JUnit in Action, Manning Publications Co."},{"key":"ref_27","unstructured":"Copeland, L. (2004). A Practitioner\u2019s Guide to Software Test Design, Artech House."},{"key":"ref_28","unstructured":"Di Lucca, G.A., Fasolino, A.R., Faralli, F., and de Carlini, U. (2002, January 3\u20136). Testing Web Applications. Proceedings of the 18th International Conference on Software Maintenance (ICSM), Montreal, QC, Canada."},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Noikajana, S., and Suwannasart, T. (2008, January 12\u201313). Web Service Test Case Generation Based on Decision Table. Proceedings of the 8th International Conference on Quality Software (QSIC), Oxford, UK.","DOI":"10.1109\/QSIC.2008.7"},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Hartmann, J., Imoberdorf, C., and Meisinger, M. (2000, January 21\u201324). UML-Based Integration Testing. Proceedings of the ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA), Portland, OR, USA.","DOI":"10.1145\/347324.348872"},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Briand, L., and Labiche, Y. (2001, January 1\u20135). A UML-Based Approach to System Testing. Proceedings of the 4th International Conference on the Unified Modeling Language: Modeling Languages, Concepts, and Tools (UML), Toronto, ON, Canada.","DOI":"10.1007\/3-540-45441-1_15"},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Endrikat, S., and Hanenberg, S. (2011, January 22\u201324). Is Aspect-Oriented Programming a Rewarding Investment into Future Code Changes? A Socio-technical Study on Development and Maintenance Time. Proceedings of the International Conference on Program Comprehension, Kingston, ON, Canada.","DOI":"10.1109\/ICPC.2011.46"},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Kiczales, G., Hilsdale, E., Hugunin, J., Kersten, M., Palm, J., and Griswold, W. (2001, January 18\u201322). An overview of AspectJ. Proceedings of the Conference on Object-Oriented Programming, Budapest, Hungary.","DOI":"10.1007\/3-540-45337-7_18"},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Tanter, \u00c9. (2010, January 15\u201319). Execution levels for aspect-oriented programming. Proceedings of the 9th International Conference on Aspect-Oriented Software Development, Rennes and Saint Malo, France.","DOI":"10.1145\/1739230.1739236"},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Montrieux, L., J\u00fcrjens, J., Haley, C.B., Yu, Y., Schobbens, P.Y., and Toussaint, H. (2010, January 20\u201324). Tool support for code generation from a UMLsec property. Proceedings of the IEEE\/ACM International Conference on Automated Software Engineering, Antwerp, Belgium.","DOI":"10.1145\/1858996.1859074"},{"key":"ref_36","unstructured":"TESEM. Available online: http:\/\/patterns.fuka.info.waseda.ac.jp."},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Kobashi, T., Yoshioka, N., Okubo, T., Kaiya, H., Washizaki, H., and Fukazawa, Y. (2013, January 2\u20136). Validating Security Design Pattern Applications Using Model Testing. Proceedings of the 8th International Conference on Availability, Reliability and Security (ARES2013), Regensburg, Germany.","DOI":"10.1109\/ARES.2013.13"},{"key":"ref_38","doi-asserted-by":"crossref","unstructured":"Yoshizawa, M., Kobashi, T., Washizaki, H., Fukazawa, Y., Okubo, T., Kaiya, H., and Yoshioka, N. (2014, January 8\u201312). Verification of Implementing Security Design Patterns Using a Test Template. Proceedings of the 9th International Conference on Availability, Reliability and Security (ARES2014), Fribourg, Switzerland.","DOI":"10.1109\/ARES.2014.31"},{"key":"ref_39","doi-asserted-by":"crossref","first-page":"1","DOI":"10.4018\/ijsse.2014100101","article-title":"Validating Security Design Pattern Applications by Testing Design Models","volume":"5","author":"Kobashi","year":"2014","journal-title":"Int. J. Secure Softw. Eng."},{"key":"ref_40","unstructured":"EMSsec. Available online: http:\/\/lab.iisec.ac.jp\/~okubo_lab\/Members\/okubo\/wiki\/index.php?EMSSec."}],"container-title":["Information"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2078-2489\/7\/2\/34\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T19:25:28Z","timestamp":1760210728000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2078-2489\/7\/2\/34"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2016,6,15]]},"references-count":40,"journal-issue":{"issue":"2","published-online":{"date-parts":[[2016,6]]}},"alternative-id":["info7020034"],"URL":"https:\/\/doi.org\/10.3390\/info7020034","relation":{},"ISSN":["2078-2489"],"issn-type":[{"type":"electronic","value":"2078-2489"}],"subject":[],"published":{"date-parts":[[2016,6,15]]}}}